- release_tracks: [ALPHA, BETA, GA]

  help_text:
    brief: Add IAM policy binding to a Cloud Spanner backup.
    description: |
      Add an IAM policy binding to a Cloud Spanner backup. One binding consists of
      a member, a role, and an optional condition.

    examples: |
      To add an IAM policy binding for the role of 'roles/spanner.backupAdmin' for the user
      'test-user@gmail.com' with backup 'example-backup' and instance 'example-instance', run:

        $ {command} example-backup \
            --instance='example-instance' \
            --member='user:test-user@gmail.com' \
            --role='roles/spanner.backupAdmin'

      To add an IAM policy binding which expires at the end of the year 2018 for the role of
      'roles/spanner.backupAdmin' and the user 'test-user@gmail.com' with backup 'example-backup'
      and instance 'example-instance', run:

        $ {command} example-backup \
            --instance='example-instance' \
            --member='user:test-user@gmail.com' \
            --role='roles/spanner.backupAdmin' \
            --condition='expression=request.time < timestamp("2019-01-01T00:00:00Z"),title=expires_end_of_2018,description=Expires at midnight on 2018-12-31'

      See https://cloud.google.com/iam/docs/managing-policies for details of
      policy role and member types.

  request:
    collection: spanner.projects.instances.backups

  arguments:
    resource:
      help_text: The Cloud Spanner backup to which to add the IAM policy binding.
      spec: !REF googlecloudsdk.command_lib.spanner.resources:backup

  iam:
    enable_condition: true
    policy_version: 3
    get_iam_policy_version_path: getIamPolicyRequest.options.requestedPolicyVersion